There is an unstructured log-file and so the field extraction is not working to extract the exceptions that occur in the log file. So, I want to use a lookup to add those error keywords in the events and get the count of those exceptions mentioned in the lookup in the logfile and display the exceptions count by _time. Is it possible? As so far now, I am only able to get the count of those exceptions in the lookup and display based on time. How do I display those particular exceptions along with the count and _time.
are you extracting the field at search time or index time?
what does your query look like right now?
what does the result set look like right now, and how are you trying to display it?
